Cyber Security Specialist - Process Control

This role is part of the D&T department of HEINEKEN International and is in Heineken Global Shared Service, Krakow, Poland. D&T is proud to bring cutting-edge innovation, strong technology, and advanced analytics to HEINEKEN. With speed and agility, we ensure HEINEKEN has the technological competitive advantages it needs to deliver on its ambition.

Digital & Technology Team (D&T) is an integral division of HEINEKEN Global Shared Services Center. We are committed to making Heineken the most connected brewery. That includes digitalizing and integrating our processes, ensuring best-in-class technology, and embedding a data-driven culture. By joining us you will work in one of the most dynamic and innovative teams and have a direct impact on building the future of Heineken!

Would you like to meet the Team, see our office and much more? Visit our website: Heineken (heineken-dt.pl).

We are looking for Cybersecurity Specialist with a strong background in OT/industrial environments to strengthen the OT related capabilities of the Cyber Defense Operations Threat Response (CDO-TR) team. CDO TR is responsible for incident response, threat hunting, and resilience of IT and OT/industrial environments, protecting HEINEKEN’s production systems and minimizing operational impact from Cyber Threats.

Your responsibilities would include:

• developing ICS-specific incident response procedures and playbooks

• investigating alerts related to PLCs, HMIs, historians, and engineering workstations

• supporting OT monitoring content and integrations development

• conducting threat detection and hunting in IT & OT environments

• performing triage, investigation, containment, and recovery

• coordinating with SOC teams, security champions, and vendors

• providing remote/on-site incident response support

• overseeing external vendors and service providers

• driving continuous improvement via lessons learned

• hosting duty assignment as the primary or backup incident handler of the week for the duty duration, typically these are two-week schedules aligned within the responder’s team, at least a quarter in advance

• maintaining 24/7 readiness and response capability for cybersecurity incidents.

You are a good candidate if you have:

• bachelor’s degree or equivalent experience

• knowledge of SCADA, DCS, PLCs, RTUs, and HMIs

• knowledge of industrial protocols (Modbus, OPC, DNP3)

• knowledge of MITRE ATT&CK for ICS

• understanding of authentication and remote access controls

• 5+ years of experience in Operational Technology with a strong focus on Cyber Security

• experience in manufacturing, energy, or utilities

• experience with OT security tools (Nozomi, Claroty, Dragos, Defender for IoT)

• familiarity with IT/OT hybrid environments

• experience with ITIL frameworks

• ability to translate technical issues into business and operational impact

• strong collaboration skills across IT and OT teams

• ability to work in high-pressure situations

• strong analytical and investigation skills

• proactive mindset with a strong sense of ownership

• strong communication and stakeholder management skills

• continuous learning attitude

• self-organizing skills

• ability to mentor junior staff.

You are a perfect candidate if you also have:

• ability to leverage GenAI to enhance productivity and efficacy

• scripting skills (Python, PowerShell)

• experience with Incident Response and SOC processes

• experience with SIEM/SOAR solutions (preferably SentinelOne, Sentinel, Defender, ServiceNow)

• familiarity with Agile ways of working.

At HEINEKEN Kraków, we take integrity and ethical conduct seriously. If someone has concerns about a possible violation of legal regulations indicated in Polish Whistleblowing Act or our Code of Business Conduct, we encourage them to speak up. Cases can be reported to global team or locally (in line with the local HGSS Whistleblowing procedure) by selecting proper option in this tool or by communicating it on hotline. #LI-HYBRID